Employee Privacy Notice

1. Introduction and responsibility for data privacy

We hold and process data on all current and former staff, those applying to work for us and third parties whose information you provide to us in connection with the employment or other working relationship (eg emergency contact information and/or dependents).

This Employee Privacy Notice applies to all current and former employees, workers, individual contractors, applicants, agency workers, consultants and directors. References to "staff" or "you" or "your" in this Employee Privacy Notice are references to all these categories of individual. Where we use the term "employment" in this Employee Privacy Notice this includes also other engagements where you work for us but are not an employee.

We take your data protection rights and our legal obligations seriously. Your personal data will be treated in a secure and confidential manner and only as set out below or otherwise notified to you in writing.

This Employee Privacy Notice describes the categories of personal data we process, how your personal data is collected, processed, used and transferred, for what purposes we process your data and how your privacy is safeguarded in the course of our relationship with you. It is intended to provide you with information about the Company's processing of your personal data under applicable laws. Please read it carefully. This Employee Privacy Notice does not form part of your contract with us.

If you have any questions, would like to access the information in this Employee Privacy Notice in a different form, would like to exercise your rights, believe privacy rights have been violated or are concerned there may have been a breach of privacy laws, policies or procedures please contact Sarah Blackburn at Sarah.Blackburn@calvincapital.com.

2. What data do we process

The Company collects and processes your personal data for the purposes described in this Employee Privacy Notice. Personal data means any information describing or relating to an identified or identifiable individual. An identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

In accordance with and subject to applicable laws, we collect various types of personal data about you for the purposes described in this Employee Privacy Notice. A list of the relevant categories of personal data is at Appendix 1 to this Employee Privacy Notice.

Certain additional information may be collected where this is necessary and permitted by local applicable laws and if this arises we will let you know.

Apart from personal data relating to you, you will also provide the Company with personal data of third parties, notably your dependents and other family members, for purposes of HR administration and management, including the administration of benefits and to contact someone in an emergency. Before you provide such third party personal data to the Company you must first inform these third parties of any such data which you intend to provide to the Company and of the processing to be carried out by the Company, as detailed in this Employee Privacy Notice.

2.1 Special Category Personal Data

To the extent permitted by applicable laws the Company will collect and process a limited amount of personal data falling into special categories, sometimes called "sensitive personal data" for example, health information. A list of what is included in the term special category data is set out at Appendix 2 to this Employee Privacy Notice.

3. How does the company collect data?

The Company collects and records your personal data from a variety of sources, but mainly directly from you. You will usually provide this information directly to your managers or local Human Resources (HR) contact or enter it into our systems (for example, through your participation in HR processes, emails you send or through verbal information which will be recorded electronically or manually). In addition, we collect your personal data from your managers, HR, or occasionally your colleagues (for example, manager feedback and assessment, evidence from colleagues in investigations or peer review exercises).

We will also obtain some information from third parties: for example, references from a previous employer, medical reports from external professionals, information from tax authorities, benefit providers or where we employ a third party to carry out a pre-employment background check (where permitted by applicable law).

In some circumstances, data will be collected indirectly (for example building and system access or use logs email and Internet records).

Where we ask you to provide personal data to us on a mandatory basis, we will inform you of this at the time of collection. Failure to provide certain information will mean that we cannot carry out certain HR processes. For example, if you do not provide us with your bank details, we will not be able to pay you. In some cases it means that we may be unable to continue with your employment or engagement as the Company will not have the personal data we believe to be necessary for the effective and efficient administration and management of our relationship with you. If this is the case we will let you know.

4. What are the purposes for which data is processed and what is our legal basis for carrying out the processing?

4.1 The legal basis on which we process your personal data

Whenever we process your personal data we do so on the basis of a legal basis or justification for that processing. Processing of special categories of data is always justified on the basis of an additional lawful condition. In the majority of cases, the processing of your personal data will be justified on one of the following basis:

4.1.1 The processing is necessary for compliance with a legal obligation to which the Company is subject; or

4.1.2 Where the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into such a contract; or

4.1.3 We also process your personal data where the processing is in accordance with legitimate interests pursued by the Company, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data. Where we rely on legitimate interests, we have summarised the legitimate interest we rely on in this Employee Privacy Notice.

If our processing involves the collection or use of special categories of data, where that is permitted under applicable laws, we also rely on an additional legal justification set out below in section 4.3.

We will, on occasion, process your personal data for the purpose of legitimate interests pursued by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data (for example to meet the security requirements of our customers).

In exceptional circumstances, you may ask us to process data for a particular purpose, we will carry out the processing on your instruction and on your behalf (for example if you ask us to provide pay information to a bank for a mortgage application made by you).

4.2 The purposes we use personal data for and the legal basis that applies

We have identified a number of purposes for collecting and processing your personal data which, are subject to applicable data protection laws. We have set out in Appendix 3 to this Employee Privacy Notice the purposes we use your personal data for and the legal basis we rely on in each case.

4.3 Additional legal basis we rely on where we process special category data

The special categories of personal data that will be processed by the Company are set out at Appendix 2 to this Employee Privacy Notice. Where we process special categories of data it will be justified by a condition set out at 4.1 above and also by one of the following additional conditions:

4.3.1 The processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws;

4.3.2 The processing is necessary for the purposes of preventive or occupational medicine, for the assessment of your working capacity, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services, to the extent permitted by applicable laws;

4.3.3 The processing is necessary to protect your vital interests or of another person where you are physically or legally incapable of giving consent (for example in exceptional emergency situations, such as a medical emergency);

4.3.4 The processing is necessary for purposes authorised by applicable law. This includes ensuring equality of opportunity or treatment between people of different racial or ethnic origins, holding different religious or philosophical beliefs, people with different states of physical or mental health or people of different sexual orientation with a view to enabling such equality to be promoted or maintained;

4.3.5 The processing is necessary for the establishment, exercise or defence of legal claims; or

4.4 The purposes we use special category personal data for and the additional legal basis that applies

We have identified a number of purposes for collecting and processing your special category personal data. These are set out at Appendix 4 to this Employee Privacy Notice together with the additional legal basis we rely on in each case.

We may on an exceptional basis seek your consent to certain processing which is not otherwise justified under one of the above basis. If consent is required for the processing in question, it will be sought from you separately. Information regarding such processing will be provided to you at the time that consent is requested, along with the impact of not providing any such consent. It is not a condition or requirement of your employment to agree to any request for consent from the Company.

4.5 Processing data relating to criminal convictions and offences

Personal data relating to criminal convictions and offences will only be processed where authorised by applicable laws. For example an allegation of a criminal offence or conviction arising during your relationship with the Company will be processed (e.g. in a disciplinary process) for the purpose of making decisions regarding your relationship with the Company.

Additional information regarding specific processing of personal data will be notified to you or set out in applicable policies where appropriate. This additional information is to ensure you have access to full details of the relevant data and purposes it is used for where it would be disproportionate to set that out in this Employee Privacy Notice and it is not obvious.

5. Retention of personal data

The Company endeavours to ensure that personal data are kept as current as possible and that irrelevant or excessive data are deleted or made anonymous as soon as reasonably practicable. The Company's general approach is to only retain personal data for as long as is required to satisfy the purpose for which it was collected by us or provided by you. This will usually be the period of your employment/contract with us plus the length of any applicable statutory limitation period following your departure, although some data, such as pension information, will need to be kept for longer and some information will be deleted earlier. We will keep some specific types of data, for example, tax records, for different periods of time, as required by applicable law. However, some personal data will be retained for varying time periods in order to comply with legal and regulatory obligations and for other legitimate business reasons. Please refer to the Calvin Data Retention Policy for more information.

6. Disclosures of personal data

Within the Company, your personal data can be accessed by or will be disclosed internally on a need to know basis to Human Resources; management responsible for managing or making decisions in connection with your relationship with the Company or when involved in an HR process concerning your relationship with the Company; system administrators; and where necessary for the performance of their role, by staff in the Company teams such as the Finance and IT Department and the HR information systems support teams.

Certain basic personal data will also be accessible to other employees through Company directories.

Your personal data will also be accessed where appropriate by third parties whom we work together with, recruitment platforms we use and benefit providers for providing us with services, such as hosting, supporting and maintaining our HR systems or the provision of advice or employee benefits. These providers will change from time to time.

Examples of third parties with whom your data will be shared where appropriate include tax and social security authorities, regulatory authorities, the Company's insurers, bankers, IT administrators, lawyers, auditors, investors, health and safety consultants, occupational health providers and other professional advisors, recruitment platforms we use, HR system providers (e.g. Vitality/EasyBop) payroll providers (Moorepay), benefit providers and administrators third party staff vetting providers and medical advisers where we seek a report. The Company expects such third parties to process any data disclosed to them in accordance with applicable law, including with respect to data confidentiality and security.

Where these third parties act as a "data processor" (for example a payroll provider) they carry out their tasks on our behalf and upon our instructions for the above mentioned purposes. In this case your personal data will only be disclosed to these parties to the extent necessary to provide the required services. We will enter into a data processing or similar agreement with such third parties ensuring appropriate protection for your personal data. Under such agreements, we will be liable for the onward transfer of your personal data.

7. Security of data

The Company is committed to protecting the security of the personal data you share with us. In support of this commitment, we have implemented appropriate technical, physical and organisational measures to ensure a level of security appropriate to the risk. The Company uses a variety of technical and organisational methods to secure your personal data in accordance with applicable laws.

8. International transfer of personal data

We do not currently transfer your data outside of the EU.

9. Your rights as a data subject

9.1 Right to access, correct and delete your personal data

The Company aims to ensure that all personal data are correct. You also have a responsibility to ensure that changes in personal circumstances (for example, change of address and bank accounts) are notified to the Company so that we can ensure that your data is up to date.

You have the right to request access to any of your personal data that the Company will hold, and to request correction of any inaccurate data relating to you. You furthermore have the right to request deletion of any irrelevant data we hold about you.

9.2 Data portability

Where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the legal basis for processing, and that personal data is processed by automatic means, you have the right to receive all such personal data which you have provided to the Company in a structured, commonly used and machine readable format, and also to require us to transmit it to another controller where this is technically feasible.

9.3 Right to restriction of processing:

You have the right to restrict our processing of your personal data where:

• you contest the accuracy of the personal data until we have taken sufficient steps to correct or verify its accuracy;
• where the processing is unlawful but you do not want us to erase the data;
• where we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
• where you have objected to processing justified on legitimate interest grounds (see below) pending verification as to whether the Company has compelling legitimate grounds to continue processing.

Where personal data is subjected to restriction in this way we will only process it with your consent or for the establishment, exercise or defence of legal claims.

9.4 Right to withdraw consent

Where we have relied on your consent to process particular information and you have provided us with your consent to process data, you have the right to withdraw such consent at any time. You can do this by (i) in some cases deleting the relevant data from the relevant HR system (although note that in this case it will remain in back ups and linked systems until it is deleted in accordance with our data retention policy) or (ii) contacting Human Resources. It will only however be rarely that we rely on your consent to process personal data for your employment or engagement.

9.5 Right to object to processing justified on legitimate interest grounds

Where we are relying upon legitimate interest to process data, then you have the right to object to that processing. If you object, we must stop that processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or where we need to process the data for the establishment, exercise or defence of legal claims. Where we rely upon legitimate interest as a basis for processing we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.

9.6 Right to complain

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you consider that the processing of your personal data infringes applicable law (https://ico.org.uk).

For further information regarding your rights, or to exercise any of your rights, please contact: Sarah Blackburn at Sarah.Blackburn@calvincapital.com.

10. Notice of changes

The Company will change or update this Employee Privacy Notice at any time. Should we change our approach to data protection, you will be informed of these changes or made aware that we have updated the Employee Privacy Notice so that you know which information we process and how we use this information. This Employee Privacy Notice was last updated and reviewed on 18 April 2018.

• Recruitment and candidate selection data: skills and experience, qualifications,references, employment and academic history, CV and application and selection records, references and pre-employment check results, information related to the outcome of your application, details of any offer made to you;

APPENDIX 3

The purposes Calvin uses your personal data for and the legal basis it relies on

No.

Purpose for processing

The lawful basis we rely on and additional detail about our legitimate interest where relevant

a)

Recruitment and selection

To assess your suitability to work for us, compare you with other applicants and make a decision whether to offer you employment;

To consider any adjustments or accommodations for the recruitment process or if you were to commence work with us in the event you have a disability.

Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including the requirement to ensure we do not unlawfully discriminate in our recruitment decision.

Some of this processing is necessary for taking steps at your request to enter into a contract with you. Where you have applied to work for us we need to use your personal data to make an offer of employment to you where appropriate.

Additional processing, such as is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in fully assessing applicants to ensure that only suitable and appropriate candidates are selected, to compare candidates and decide who to recruit. The Company aims to recruit the best person for each vacancy through fair, systematic, effective recruitment and selection procedures.

b)

References and pre-employment checks

References, verification of your identity, home address, academic and work history and right to work.

This processing is necessary for the compliance with the legal obligation to establish your right to work in the UK.

Additional checks are necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in ensuring that candidates for employment or engagement do not pose an unacceptable risk to the business and considers the verification carried out necessary to protect the business.

c)

Job offers - Making job offers and providing contracts of employment.

On boarding and HR administration - Taking steps to on board youwhere you accept an offer from us including transferring relevant recruitment information onto employment records and the day to day administration of your employment.

Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including the requirement to issue written particulars or terms of employment and the requirement not to unlawfully discriminate in the terms of any offer to you.

Additionally, some of this processing is necessary to take steps to enter into the contract between you and the Company and to perform that contract to make an appropriate offer to you and administer your employment contract if you join us.

Other aspects of the processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in ensuring the effective engagement of staff on appropriate terms and conditions of employment, that there is a smooth transition into employment for successful candidates and an effective administration of the employment relationship.

d)

Future job opportunities

To contact you if you are not successful should another potentially suitable vacancy arise during the six months following completion of the recruitment process for the role you applied for.

This processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in maintaining an appropriate pool of talent who have shown an interest in working for the Company and who are potentially suitable candidates for employment. This will potentially benefit both initially unsuccessful candidates and the Company.

e)

Recruitment queries and challenges

To deal with any query, challenge, request for feedback or claim received in relation to our recruitment decisions.

This processing is necessary for the compliance with legal obligations to which the Company is subject including ensuring that the Company is able to demonstrate its compliance with data protection laws and anti-discrimination laws.

Beyond legal compliance, processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in being able to provide feedback to candidates and to be able to defend any challenge or claim made in connection with our recruitment decision.

Processing related to role related training is necessary to perform the contract between you and the Company.

The other aspects of processing are necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in managing its workforce and operating its business. This includes ensuring that each employee is trained for their role. It also includes ensuring that there are succession and contingency plans in place so that the business can maintain knowledge, skills and relationships. This also includes supporting and developing our personnel in their career to help the Company retain engaged, motivated, high calibre employees.

g)

Pay, benefits and pension

Awarding, providing and administering remuneration, pension, benefits and incentive schemes and reimbursement of business costs and expenses and making appropriate tax and social security deductions and contributions.

We may use performance review data for remuneration award purposes.

This processing is necessary for the compliance with legal obligations to which the Company is subject including the provision of statutory payments, pension and benefits and complying with the requirements of the tax authorities in relation to tax and social security.

Processing is also necessary to perform the contract between you and the Company in order to provide and administer the payments, pension and benefits we have agreed to provide to you as part of your contract of employment.

This processing is also necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in ensuring that remuneration is set an appropriate level and properly administered.

h)

Work management

Allocating and managing duties and responsibilities and the business activities to which they relate, including business travel.

Some processing is necessary to perform the contract between you and the Company to ensure that you carry out the role under your contract of employment.

Additional processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in managing its workforce and business. This includes ensuring the effective allocation and organisation of work amongst its employees and ensuring that each employee carries out appropriate duties.

Effective employee management in this way is important to enable the Company to carry out its commitments to customers and to manage its resources efficiently and effectively.

i)

Identification and communication

Identifying and communicating effectively with staff.

Using your data to communicate with you is necessary for the compliance with legal obligations to which the Company is subject including the need to communicate with you regarding processes governed by employment laws (e.g. a consultation exercise or investigation) or as part of our duty of care towards you.

Processing is also necessary to perform the contract between you and the Company.

Additional processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company also has a legitimate interest in contributing to appropriate safety and security by ensuring that employees can be identified.

The Company also has a legitimate interest in facilitating effective communication and collaboration between staff and between staff and others to maximise operational performance and collaboration and to help staff work together for the benefit of the business and the Company's customers.

j)

Performance and Talent Reviews

Setting performance expectations and objectives, monitoring and measuring performance against goals and objectives, managing and operating performance reviews and career potential reviews.

This processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in setting objectives for staff to ensure that members of staff are aligned to the needs and goals of the Company; in measuring the achievement of staff against those objectives; and assessing the development needs staff to ensure the highest standards of performance and to support career.

The Company has a further legitimate interest in ensuring an appropriate performance related measure to support fair, consistent, objective performance related reward and to support performance assessment for the purpose of other HR processes.

k)

Formal HR Management Procedures

Dealing with issues and concerns relating to performance, capability, absence, conduct and employee complaints including informal and formal performance management, disciplinary and grievance related reviews, managing allegations and complaints, investigations and other informal and formal HR processes and making related management decisions.

This processing is necessary for the compliance with legal obligations to which the Company is subject, including our duty of care towards you, to avoid unlawful dismissal and comply with anti-discrimination laws.

This processing is also necessary to perform the contract between you and the Company where we have committed to comply with certain procedures as part of your terms and conditions of employment.

Additional processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in managing its workforce and operating its business. This includes putting in place appropriate standards, policies and procedures for employees and taking action if they are not complied with.

l)

Employee Relations And Engagement

Consultations or negotiations with staff or representatives of staff.

Engagement programmes such as surveys for benchmarking and identifying improved ways of working.

This processing is necessary for the compliance with legal obligations to which the Company is subject including statutory consultation.

Processing is also necessary for the purpose of the legitimate interests pursued by the Company where the consultation or employee engagement programme is not a statutory matter. The Company has a legitimate interest in seeking the views of its workforce on business improvement opportunities and on proposals which will impact on staff. Effective employee engagement helps ensure the Company makes the best decisions for the business and is important to attract and retain high calibre employees.

m)

Absence and Incapacity Management

Processing information about absence or physical or mental health in order to: assess eligibility for incapacity related remuneration or benefits; determine working capacity; facilitate return to work; make adjustments or accommodations to duties or the workplace; make decisions regarding employment or redeployment.

Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including health and safety laws, our duty of care to staff, providing statutory incapacity benefits, avoiding unlawful dismissal and compliance with disability discrimination laws.

Additional processing is necessary to perform the contract between you and the Company including the provision of payments and benefits relating to absence or incapacity.

Additional processing is also necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in managing and supporting its workforce and taking steps to identify and mitigate risks to staff health, safety or welfare, ensure fitness for work and to manage absence and incapacity impacting on the ability of staff to perform their roles.

n)

Restructuring, corporate transactions and outsourcing

Planning, managing and carrying out restructuring or redundancies or other change programmes, corporate transactions or outsourcing of services.

We may use data from performance reviews or other HR processes for selection where appropriate in redundancy or restructuring exercises.

This processing is necessary for the compliance with employment laws to which the Company is subject including, where relevant, in relation to rules relating to the automatic transfer of staff from one organisation to another; redundancies or potential terminations due to business reasons; and laws regulating corporate transactions.

Additional processing beyond legal compliance is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in planning and implementing changes in its operations to preserve operations, maximise efficiency, grow or modernise its business in a fair and effective way.

Business change and transformation is important to ensure business continuity and to support the Company's immediate and long-term business goals and outcomes.

o)

IT Network and system protection and operation of and compliance with Company policies and procedures

Including audits and compliance monitoring, access controls and permissions.

Including related system maintenance.

This processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in managing its workforce and operating its business and protecting its business and all stakeholders (including customers, employees and shareholders) from various risks.

This includes putting in place appropriate standards, policies and procedures for employees, measuring compliance, detecting breaches and taking action if they are not complied.

It also includes appropriate protection of the IT network, systems and business devices to maintain the integrity and security of data and business information and facilitating records management.

This is important to maintain business standards, ensure business continuity and to protect the Company's operation and reputation.

See Use of Computers, Email and Internet Chapter of the Employee Handbook for more information on IT use and monitoring.

This processing is necessary for the compliance with legal obligations to which the Company is subject including health and safety laws, our duty of care, data protection and other laws to which the Company is subject.

Processing is also necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in ensuring that its business, customers, employees, assets and systems are safe and secure.

q)

Business protection

This processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in ensuring that its business, customers, employees, assets, systems, business relationships and information are protected.

This is important to comply with our obligations to our customers and staff to protect their information and assets as well as to protect the Company's business.

r)

Compliance with laws and regulation

Complying with laws and regulation applicable to the Company.

This processing is necessary for the compliance with legal obligations to which the Company is subject (for example maternity or parental leave legislation, working time and health and safety legislation, taxation rules, worker consultation requirements, other employment laws, and financial services and other regulation to which the Company is subject in the conduct of its business).

s)

Information Management, business planning and reporting

Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including statutory Company reporting obligations and corporate governance requirements.

Additional processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in managing its workforce and operating its business, ensuring appropriate governance and controls are in place and to measure and report on financial management and business performance and plan for the future. This includes appropriate preparation of internal and external reports on a range of business areas. Effective planning, management information and reporting is important for effective management of the business, risk management and decision making.

t)

Business development and customer, supplier and stakeholder liaison

For business development purposes.

For tenders for work or customer team records or to operate the day to day relationship with customers.

To operate the relationship with other third parties such as suppliers.

This processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in winning business and growing its business, complying with contracts entered into with customers, ensuring the success of customer relationships and seeking to ensure customer loyalty.

This includes the sharing of appropriate information with customers and prospective customers about who is or will be working with them to develop relationships with and support the effective performance of commitments for customers. In some cases this will also include supporting customers to comply with their legal or regulatory obligations or security requirements by having sufficient information about those providing services to them.

The Company also has a legitimate interest in ensuring that it can develop and operate the relationship with other trade partners effectively.

Supporting successful business relationships is important for business continuity, improvement and growth to help the Company achieve its short and long term goals.

u)

Business communications and media

This will sometimes include the use of photographic images where appropriate.

This processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in communicating effectively with its workforce, customers, trade partners, other stakeholders and the market and media.

That includes providing information about relevant business initiatives including identifying those of our staff who are leading the relevant matters being communicated.

Effective communication contributes to successful business relationships and maintaining and enhancing the Company's profile and reputation to support business protection, performance and growth.

v)

References

Complying with reference requests where the Company is named by the individual as a referee.

This processing is necessary for the purpose of the legitimate interests pursued by the Company and potential new employers. It is in the legitimate interests of a new employer to receive confirmation of basic employment details from the Company for the purposes of confirming a former employee's employment history.

w)

Litigation

To enforce our legal rights and obligations, and for any purposes in connection with any legal claims made by, against or otherwise involving you.

This processing is necessary for the compliance with legal obligations to which the Company is subject including demonstrating compliance with employment and health and safety laws and data protection laws.

Additional processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company considers that it has a legitimate interest in protecting its organisation from breaches of legal obligations owed to it and to defend itself from litigation to protect the Company's reputation and to protect the Company from damage or loss.

x)

Disclosure obligations

To comply with lawful requests by public authorities (including without limitation to meet national security or law enforcement requirements), discovery requests, or where otherwise required or permitted by applicable laws.

This processing is necessary for the compliance with legal obligations to which the Company is subject where there is a legal obligation to disclose information or a court or other legal order to provide information is place.

Processing is also necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in co-operating with relevant authorities, government bodies or regulators for the provision of information where appropriate. The Company wishes to maintain its reputation as a good corporate citizen and to act ethically and appropriately in all the countries in which it does business.

APPENDIX 4

The purposes Calvin uses your special category personal data for and the legal basis it relies on

No.

Purpose for processing

Additional lawful basis for special category data processing

a)

Health and medical information will be used to comply with employment, health and safety or social security laws.

This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws.

For example, to carry out statutory risk assessments and regular health and safety assessments, provide statutory incapacity or maternity benefits, avoid breaching legal duties to you, to ensure fair and lawful management of your employment, avoid unlawful termination of your employment, to administer the Company’s private medical and long term disability schemes, to make reasonable accommodations or adjustments and avoid unlawful discrimination or dealing with complaints arising in this regard.

To the extent that this data is managed by our occupational health advisers, this processing is necessary for the purposes of preventive or occupational medicine, for the assessment of your working capacity, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services, to the extent permitted by applicable laws.

b)

Special category personal data of any type will be used in the management and investigation of any complaint under the Company's grievance, whistleblowing, anti‑bullying and harassment or similar policies and procedures or disciplinary procedures where such information is sufficiently relevant to the particular complaint or issue.

This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws. In particular employment laws relating to the effective management of complaints and avoiding unlawful dismissals, anti-discrimination laws and our duty of care to staff.

We are here to help and offer support wherever possible. Should you have any questions regarding our services please do not hesitate to let us know.